ff75a79fcff33c73fe22c72449085f9503fa530430139d8d340e4a891f17f9b1

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-07-2023 11:19

Target

easy_Benign_ff75a79fcff33c73fe22c72449085f9503fa530430139d8d340e4a891f17f9b1.dll
Size

17KB
MD5

08c3d2e90fadfdf7e64a41889f67b476
SHA1

9569dab9ccf9a5b8bd28bb7376e7b959c15264e4
SHA256

ff75a79fcff33c73fe22c72449085f9503fa530430139d8d340e4a891f17f9b1
SHA512

2b245e7c9cbc37895fb008535b360602298a7dc97e38bb2c943ff921328fd4ad1e4c275e63c5072ba68391b3f2846cf814221aeaa6dd7e07b1904ce38d471ae8
SSDEEP

384:+b5CBpAX6N8jQanZ8CDVfwVa0WWCCxXBhgGWXiv+:+D8MVfwVjh9Yi2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2152	2512	rundll32.exe	28
PID 2512 wrote to memory of 2152	2512	rundll32.exe	28
PID 2512 wrote to memory of 2152	2512	rundll32.exe	28
PID 2512 wrote to memory of 2152	2512	rundll32.exe	28
PID 2512 wrote to memory of 2152	2512	rundll32.exe	28
PID 2512 wrote to memory of 2152	2512	rundll32.exe	28
PID 2512 wrote to memory of 2152	2512	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\easy_Benign_ff75a79fcff33c73fe22c72449085f9503fa530430139d8d340e4a891f17f9b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\easy_Benign_ff75a79fcff33c73fe22c72449085f9503fa530430139d8d340e4a891f17f9b1.dll,#1
  2⤵
  PID:2152